#Container Security
All CosmicBytez Labs articles tagged #Container Security, across news, security advisories, how-to guides, and projects.
- News
Docker Hub Flaw (CVE-2026-105445) Let Attackers Impersonate Users and Tamper With Images
Docker disclosed a critical flaw (CVSS 9.4) letting attackers hijack PATs to impersonate users and tamper with container images.
- HOWTO
Container Image Signing and Verification with Cosign and Sigstore
Sign your container images with Cosign's keyless Sigstore workflow, verify signatures before deploy, and enforce the policy in Kubernetes so unsigned images never run.
- Security
CVE-2026-107935: gvproxy Path Traversal Allows Unauthenticated Host File Deletion
A critical gvproxy flaw (CVSS 9.3) lets attackers delete arbitrary host files via its unauthenticated /expose endpoint, breaking VM-host isolation.
- News
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato hijacks exposed Docker daemons on port 2375 to install a weaponized Hermes AI agent that steals LLM API keys via Telegram commands.
- HOWTO
Software Bill of Materials (SBOM) Generation with Syft and Grype
Generate a complete inventory of every package, library, and dependency in your containers and codebases with Syft, then scan that inventory for known...
- News
Chainguard Surpasses 1 Billion Container Build Manifests With Factory 2.0
Chainguard doubled its build volume to over 1 billion manifests in six months, powered by an automated factory rebuilding images at scale.
- News
Chainguard Doubles Output to 1 Billion Build Manifests in Six Months
Chainguard's container image factory doubled its rebuild output from 500 million to over 1 billion manifests, driven by a new agentic pipeline.
- Security
Unauthenticated Root RCE in AutoAgent's Sandbox TCP Server
AutoAgent's sandbox TCP command server binds to all interfaces with no authentication, letting anyone execute root shell commands inside the...
- Project
Container Supply Chain Security: SBOMs and Keyless Signing with Syft, Grype, and Cosign
Build a CI pipeline that generates SBOMs with Syft, scans them for vulnerabilities with Grype, and signs container images keylessly with Cosign — closing...
- Security
CVE-2026-66897: Critical LXD Path Traversal Allows Host File Overwrite
A CVSS 9.9 path traversal flaw in LXD's template processing lets attackers with container permissions overwrite arbitrary host files.
- Security
CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints
docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.
- Security
CVE-2026-48749: Incus Malicious Image Arbitrary File Write and RCE (CVSS 9.9)
Critical Incus flaw lets a specially crafted container image read or write arbitrary host files, leading to remote code execution. Fixed in v7.2.0.
- Security
CVE-2026-48750: Incus Exec-Output Symlink Attack Enables Host File Write (CVSS 9.9)
Critical Incus flaw: if exec-output is a symlink, command output files are written to arbitrary host paths. Fixed in v7.2.0.
- Security
CVE-2026-62940: Incus Migration Security Restriction Bypass (CVSS 9.9)
Critical Incus flaw allows privilege escalation via unrestricted config overrides during cross-cluster instance migration. Patch to v7.3.0.
- Security
CVE-2026-62941: Incus Cross-Project Copy Privilege Escalation (CVSS 9.9)
Critical TOCTOU flaw in Incus lets restricted project users escalate privileges by copying instances across projects. Fixed in v7.3.0.
- Security
CVE-2026-36576: Critical OS Command Injection in docker-wkhtmltopdf-aas
A CVSS 9.8 OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas allows unauthenticated remote code execution via a crafted POST request to…
- Security
CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability
A Linux kernel vulnerability in the cgroups v1 release_agent feature allows local attackers to escalate privileges and escape containers. Added to CISA KEV…
- News
Open Source DockSec Uses AI to Cut Through Vulnerability
DockSec, an OWASP incubator project, combines multiple container security scanners with AI-generated plain-English remediation guidance and exact Dockerfile.
- Security
CVE-2026-42296: Argo Workflows templateReferencing Strict
A high-severity security bypass in Argo Workflows (CVSS 8.1) allows users with Workflow creation permissions to escape templateReferencing: Strict mode,...
- Security
CVE-2026-34177: Canonical LXD Incomplete VM Restriction
A critical CVSS 9.1 flaw in Canonical LXD versions 4.12 through 6.7 omits raw.apparmor and raw.qemu.conf from the VM low-level option denylist, allowing...
- Security
CVE-2026-34178: Canonical LXD Backup Import Path
A critical CVSS 9.1 vulnerability in Canonical LXD before 6.8 allows authenticated attackers to bypass project restrictions during backup import. The...
- News
Chainguard Unveils Factory 2.0 to Automate Hardening the Software Supply Chain
The rebuilt Chainguard Factory platform adds deeper security automation designed to continuously reconcile open source artifacts across containers,...
- News
The State of Trusted Open Source Report: Key Findings for 2025
Chainguard's first-ever State of Trusted Open Source report reveals critical insights into open source consumption patterns across container images,...
- HOWTO
How to Deploy Falco for Kubernetes Runtime Security
Step-by-step guide to deploying Falco as a Kubernetes runtime security engine. Covers Helm installation, custom rule authoring, Falcosidekick alerting...
- News
VoidLink: AI-Generated Cloud-Native Malware Framework
Researchers uncover VoidLink, an 88,000-line Zig-based malware framework built with AI assistance that targets AWS, Azure, GCP, and Kubernetes environments.